Application is not working(Crashing while opening whatsapp) on android 13 Google Pixel 4XL

[Iamzaryab]

Describe the bug / 描述一下这个错误 When i start whatsapp it crash To Reproduce / 复现步骤 Steps to reproduce the behavior: Just install whatsapp in the application and run it will crash

Expected behavior / 预期的行为 A clear and concise description of what you expected to happen. 清晰而简明地描述你所期望发生的事情。

Screenshots / 截图 If applicable, add screenshots to help explain your problem. 如果有，请添加屏幕截图以帮助解释你的问题。

Mobile Phone Info / 手机信息 android 13 Google Pixel 4XL Logcat / 日志 If you are a developer or capable please provide logs for us to analyze. 2023-02-23 15:39:20.223 4761-4761/com.whatsapp.w4b E/AndroidRuntime: FATAL EXCEPTION: main Process: com.whatsapp.w4b, PID: 4761 java.lang.RuntimeException: Unable to makeApplication at top.niunaijun.blackbox.app.BActivityThread.handleBindApplication(BActivityThread.java:390) at top.niunaijun.blackbox.app.BActivityThread.bindApplication(BActivityThread.java:294) at top.niunaijun.blackbox.fake.service.HCallbackProxy.handleLaunchActivity(HCallbackProxy.java:168) at top.niunaijun.blackbox.fake.service.HCallbackProxy.handleMessage(HCallbackProxy.java:82) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loopOnce(Looper.java:201) at android.os.Looper.loop(Looper.java:288) at android.app.ActivityThread.main(ActivityThread.java:7898) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936) Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'void android.app.Application.onCreate()' on a null object reference at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1266) at top.niunaijun.blackbox.fake.delegate.BaseInstrumentationDelegate.callApplicationOnCreate(BaseInstrumentationDelegate.java:225) at top.niunaijun.blackbox.fake.delegate.AppInstrumentation.callApplicationOnCreate(AppInstrumentation.java:140) at top.niunaijun.blackbox.app.BActivityThread.handleBindApplication(BActivityThread.java:377) at top.niunaijun.blackbox.app.BActivityThread.bindApplication(BActivityThread.java:294)  at top.niunaijun.blackbox.fake.service.HCallbackProxy.handleLaunchActivity(HCallbackProxy.java:168)  at top.niunaijun.blackbox.fake.service.HCallbackProxy.handleMessage(HCallbackProxy.java:82)  at android.os.Handler.dispatchMessage(Handler.java:102)  at android.os.Looper.loopOnce(Looper.java:201)  at android.os.Looper.loop(Looper.java:288)  at android.app.ActivityThread.main(ActivityThread.java:7898)  at java.lang.reflect.Method.invoke(Native Method)  at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)  2023-02-23 15:39:23.653 2058-11902/? E/TaskPersister: File error accessing recents directory (directory doesn't exist?). 2023-02-23 15:39:23.653 2058-11902/? E/TaskPersister: File error accessing recents directory (directory doesn't exist?). 2023-02-23 15:39:38.831 4839-4839/? E/m.facebook.lite: Not starting debugger since process cannot load the jdwp agent. 2023-02-23 15:39:39.353 4839-4884/? E/AppController: Unsupported advanced HNF choice

Additional context / 额外内容 Add any other context about the problem here. 在此添加关于该问题的任何其他内容。

APK If applicable, add the apk file for me to test. 如果有，请添加APK文件给我测试。

[panzhi1]

请问解决了吗

[mubasher380]

请问解决了吗???

[panzhi1]

请问解决了吗？？？

你也遇到了？

[mubasher380]

是的，我也遇到了 你找到任何解决办法了吗

[panzhi1]

你这里的application解析失败了，自己看下吧

[mubasher380]

我知道这里的应用程序失败了，但我不明白你为什么有任何想法或者你会修复它吗？

[panzhi1]

我这边反正没有遇到l了。我安装的whatsapp 没有问题

[Iamzaryab]

any luck how to work this code in android 13?

[panzhi1]

I have no problem on android 13

[Iamzaryab]

you are using same code base?

[Iamzaryab]

or you have done any modification in code?

[Iamzaryab]

it is not working on android 12 nor 13 i have pixel 3a and pixel 4XL

[panzhi1]

XposedHelpers.findAndHookMethod("android.app.PendingIntent", context.getClassLoader(), "checkFlags", int.class, String.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) { if (param.args[0] != null) { int flags = (int) param.args[0]; final boolean flagImmutableSet = (flags & PendingIntent.FLAG_IMMUTABLE) != 0; final boolean flagMutableSet = (flags & PendingIntent.FLAG_MUTABLE) != 0; if (!flagImmutableSet && !flagMutableSet) { param.args[0] = ((int) param.args[0]) | PendingIntent.FLAG_IMMUTABLE; } } } });

As far as I remember, android 12 needs to adapt pending intent, but this and what you provided

[mubasher380]

XposedHelpers.findAndHookMethod("android.app.PendingIntent", context.getClassLoader(), "checkFlags", int.class, String.class, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) { if (param.args[0] != null) { int flags = (int) param.args[0]; final boolean flagImmutableSet = (flags & PendingIntent.FLAG_IMMUTABLE) != 0; final boolean flagMutableSet = (flags & PendingIntent.FLAG_MUTABLE) != 0; if (!flagImmutableSet && !flagMutableSet) { param.args[0] = ((int) param.args[0]) | PendingIntent.FLAG_IMMUTABLE; } } } });

As far as I remember, android 12 needs to adapt pending intent, but this and what you provided For android 13 where we have to paste this code???

[panzhi1]

you can try

[Iamzaryab]

you can try

where to paste it?

[panzhi1]

doAttachBaseContex in BlackBoxCore

[panzhi1]

you can try

where to paste it?

Is your problem solved?

[mubasher380]

you can try

where to paste it?

Is your problem solved?

no, still my problem is not solved, do you find any solution????

[lhm12520]

I have no problem on android 13

你好，你这边可以在 android 13 上运行吗？我这边在13上无法安装

[panzhi1]

可以运行

[mubasher380]

可以运行

所以请帮助我们，我们被困在 android 13 中，我们也想在 android 13 上运行这个项目

[mubasher380]

I have no problem on android 13

你好，你这边可以在 android 13 上运行吗？我这边在13上无法安装

同样这个问题也发生在我这边

[lhm12520]

可以运行

你好，能加下联系方式吗？我这边被困在这个问题这里了

[panzhi1]

`public class IPackageManagerProxy extends BinderInvocationStub { public static final String TAG = "PackageManagerStub";

public IPackageManagerProxy() {
    super(BRActivityThread.get().sPackageManager().asBinder());
}

@Override
protected Object getWho() {
    return BRActivityThread.get().sPackageManager();
}

@Override
protected void inject(Object baseInvocation, Object proxyInvocation) {
    BRActivityThread.get()._set_sPackageManager(proxyInvocation);
    replaceSystemService("package");
    Object systemContext = BRActivityThread.get(BlackBoxCore.mainThread()).getSystemContext();
    PackageManager packageManager = BRContextImpl.get(systemContext).mPackageManager();
    if (packageManager != null) {
        try {
            Reflector.on("android.app.ApplicationPackageManager")
                    .field("mPM")
                    .set(packageManager, proxyInvocation);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

@Override
public boolean isBadEnv() {
    return false;
}

@Override
protected void onBindMethod() {
    super.onBindMethod();
    addMethodHook(new ValueMethodProxy("addOnPermissionsChangeListener", 0));
    addMethodHook(new ValueMethodProxy("removeOnPermissionsChangeListener", 0));
    addMethodHook(new PkgMethodProxy("shouldShowRequestPermissionRationale"));
    if (!BuildCompat.isT()) {
        addMethodHook(new PkgMethodProxy("clearPackagePreferredActivities"));
    }
}

@ProxyMethod("resolveIntent")
public static class ResolveIntent extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        Intent intent = (Intent) args[0];
        String resolvedType = (String) args[1];
        int flags = getFlags(args[2]);
        ResolveInfo resolveInfo = BlackBoxCore.getBPackageManager().resolveIntent(intent, resolvedType, flags, BActivityThread.getUserId());
        if (resolveInfo != null) {
            return resolveInfo;
        }
        return method.invoke(who, args);
    }
}

@ProxyMethod("resolveService")
public static class ResolveService extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        Intent intent = (Intent) args[0];
        String resolvedType = (String) args[1];
        int flags = getFlags(args[2]);
        ResolveInfo resolveInfo = BlackBoxCore.getBPackageManager().resolveService(intent, flags, resolvedType, BActivityThread.getUserId());
        if (resolveInfo != null) {
            return resolveInfo;
        }
        return method.invoke(who, args);
    }
}

@ProxyMethod("setComponentEnabledSetting")
public static class SetComponentEnabledSetting extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        return 0;
    }
}

private static int getFlags(Object arg) {
    int flag = 0;
    if (arg instanceof Integer) {
        flag = (int) arg;
    } else if (arg instanceof Long) {
        long a = (long) arg;
        flag = (int) a;
    }
    return flag;
}

@ProxyMethod("getPackageInfo")
public static class GetPackageInfo extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        String packageName = (String) args[0];
        int flag = getFlags(args[1]);

        PackageInfo packageInfo = BlackBoxCore.getBPackageManager().getPackageInfo(packageName, flag, BActivityThread.getUserId());
        if (packageInfo != null) {
            return packageInfo;
        }
        if (AppSystemEnv.isOpenPackage(packageName)) {
            return method.invoke(who, args);
        }
        return null;
    }
}

@ProxyMethod("getPackageUid")
public static class GetPackageUid extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        MethodParameterUtils.replaceFirstAppPkg(args);
        return method.invoke(who, args);
    }
}

@ProxyMethod("getProviderInfo")
public static class GetProviderInfo extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        ComponentName componentName = (ComponentName) args[0];
        int flags = getFlags(args[1]);
        ProviderInfo providerInfo = BlackBoxCore.getBPackageManager().getProviderInfo(componentName, flags, BActivityThread.getUserId());
        if (providerInfo != null)
            return providerInfo;
        if (AppSystemEnv.isOpenPackage(componentName)) {
            return method.invoke(who, args);
        }
        return null;
    }
}

@ProxyMethod("getReceiverInfo")
public static class GetReceiverInfo extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        ComponentName componentName = (ComponentName) args[0];
        int flags = getFlags(args[1]);
        ActivityInfo receiverInfo = BlackBoxCore.getBPackageManager().getReceiverInfo(componentName, flags, BActivityThread.getUserId());
        if (receiverInfo != null)
            return receiverInfo;
        if (AppSystemEnv.isOpenPackage(componentName)) {
            return method.invoke(who, args);
        }
        return null;
    }
}

@ProxyMethod("getActivityInfo")
public static class GetActivityInfo extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        ComponentName componentName = (ComponentName) args[0];
        int flags = getFlags(args[1]);
        ActivityInfo activityInfo = BlackBoxCore.getBPackageManager().getActivityInfo(componentName, flags, BActivityThread.getUserId());
        if (activityInfo != null)
            return activityInfo;
        if (AppSystemEnv.isOpenPackage(componentName)) {
            return method.invoke(who, args);
        }
        return null;
    }
}

@ProxyMethod("getServiceInfo")
public static class GetServiceInfo extends MethodHook {

    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        ComponentName componentName = (ComponentName) args[0];
        int flags = getFlags(args[1]);
        ServiceInfo serviceInfo = BlackBoxCore.getBPackageManager().getServiceInfo(componentName, flags, BActivityThread.getUserId());
        if (serviceInfo != null)
            return serviceInfo;
        if (AppSystemEnv.isOpenPackage(componentName)) {
            return method.invoke(who, args);
        }
        return null;
    }
}

@ProxyMethod("getInstalledApplications")
public static class GetInstalledApplications extends MethodHook {

    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        int flags = getFlags(args[1]);
        List<ApplicationInfo> installedApplications = BlackBoxCore.getBPackageManager().getInstalledApplications(flags, BActivityThread.getUserId());
        return ParceledListSliceCompat.create(installedApplications);
    }
}

@ProxyMethod("getInstalledPackages")
public static class GetInstalledPackages extends MethodHook {

    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        int flags = getFlags(args[1]);
        List<PackageInfo> installedPackages = BlackBoxCore.getBPackageManager().getInstalledPackages(flags, BActivityThread.getUserId());
        return ParceledListSliceCompat.create(installedPackages);
    }
}

@ProxyMethod("getApplicationInfo")
public static class GetApplicationInfo extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        String packageName = (String) args[0];
        int flags = getFlags(args[1]);

// if (ClientSystemEnv.isFakePackage(packageName)) { // packageName = BlackBoxCore.getHostPkg(); // } ApplicationInfo applicationInfo = BlackBoxCore.getBPackageManager().getApplicationInfo(packageName, flags, BActivityThread.getUserId()); if (applicationInfo != null) { return applicationInfo; } if (AppSystemEnv.isOpenPackage(packageName)) { return method.invoke(who, args); } return null; } }

@ProxyMethod("queryContentProviders")
public static class QueryContentProviders extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        int flags = getFlags(args[2]);
        List<ProviderInfo> providers = BlackBoxCore.getBPackageManager().
                queryContentProviders(BActivityThread.getAppProcessName(), BActivityThread.getBUid(), flags, BActivityThread.getUserId());
        return ParceledListSliceCompat.create(providers);
    }
}

@ProxyMethod("queryIntentReceivers")
public static class QueryBroadcastReceivers extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        Intent intent = MethodParameterUtils.getFirstParam(args, Intent.class);
        String type = MethodParameterUtils.getFirstParam(args, String.class);
        Integer flags = MethodParameterUtils.getFirstParam(args, Integer.class);
        List<ResolveInfo> resolves = BlackBoxCore.getBPackageManager().queryBroadcastReceivers(intent, flags, type, BActivityThread.getUserId());

        // http://androidxref.com/7.0.0_r1/xref/frameworks/base/core/java/android/app/ApplicationPackageManager.java#872
        if (BuildCompat.isN()) {
            return ParceledListSliceCompat.create(resolves);
        }

        // http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/app/ApplicationPackageManager.java#699
        return resolves;
    }
}

@ProxyMethod("resolveContentProvider")
public static class ResolveContentProvider extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        String authority = (String) args[0];
        int flags = getFlags(args[1]);
        ProviderInfo providerInfo = BlackBoxCore.getBPackageManager().resolveContentProvider(authority, flags, BActivityThread.getUserId());
        if (providerInfo == null) {
            return method.invoke(who, args);
        }
        return providerInfo;
    }
}

@ProxyMethod("canRequestPackageInstalls")
public static class CanRequestPackageInstalls extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        MethodParameterUtils.replaceFirstAppPkg(args);
        return method.invoke(who, args);
    }
}

@ProxyMethod("getPackagesForUid")
public static class GetPackagesForUid extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        int uid = (Integer) args[0];
        if (uid == BlackBoxCore.getHostUid()) {
            args[0] = BActivityThread.getBUid();
            uid = (int) args[0];
        }
        String[] packagesForUid = BlackBoxCore.getBPackageManager().getPackagesForUid(uid);
        Slog.d(TAG, args[0] + " , " + BActivityThread.getAppProcessName() + " GetPackagesForUid: " + Arrays.toString(packagesForUid));
        return packagesForUid;
    }
}

@ProxyMethod("getInstallerPackageName")
public static class GetInstallerPackageName extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        // fake google play
        return "com.android.vending";
    }
}

@ProxyMethod("getSharedLibraries")
public static class GetSharedLibraries extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        // todo
        return ParceledListSliceCompat.create(new ArrayList<>());
    }
}

@ProxyMethod("getComponentEnabledSetting")
public static class getComponentEnabledSetting extends MethodHook {
    @Override
    protected Object hook(Object who, Method method, Object[] args) throws Throwable {
        return PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
    }
}

}` 请尝试替换这个类

[panzhi1]

可以运行

你好，能加下联系方式吗？我这边被困在这个问题这里了

抱歉 不加联系方式，有问题可以把你的崩溃日志发到我邮箱，有时间看到会回复

[panzhi1]

同时修改HCallbackProxy这个类：` if (BuildCompat.isS()) { Object record = BRActivityThread.get(BlackBoxCore.mainThread()).getLaunchingActivity(token); ActivityThreadActivityClientRecordContext clientRecordContext = BRActivityThreadActivityClientRecord.get(record); clientRecordContext._set_intent(stubRecord.mTarget); clientRecordContext._set_activityInfo(activityInfo); clientRecordContext._set_packageInfo(BActivityThread.currentActivityThread().getPackageInfo());

            checkActivityClient();
        }`  替换成

if (BuildCompat.isS()) { Object record = BRActivityThread.get(BlackBoxCore.mainThread()).getLaunchingActivity(token); if (record != null) { ActivityThreadActivityClientRecordContext clientRecordContext = BRActivityThreadActivityClientRecord.get(record); clientRecordContext._set_intent(stubRecord.mTarget); clientRecordContext._set_activityInfo(activityInfo); clientRecordContext._set_packageInfo(BActivityThread.currentActivityThread().getPackageInfo()); } else { LaunchActivityItemContext launchActivityItemContext = BRLaunchActivityItem.get(r); launchActivityItemContext._set_mIntent(stubRecord.mTarget); launchActivityItemContext._set_mInfo(activityInfo); } checkActivityClient(); }

问题应该会得到解决

[lhm12520]

同时修改HCallbackProxy这个类：` if (BuildCompat.isS()) { Object record = BRActivityThread.get(BlackBoxCore.mainThread()).getLaunchingActivity(token); ActivityThreadActivityClientRecordContext clientRecordContext = BRActivityThreadActivityClientRecord.get(record); clientRecordContext._set_intent(stubRecord.mTarget); clientRecordContext._set_activityInfo(activityInfo); clientRecordContext._set_packageInfo(BActivityThread.currentActivityThread().getPackageInfo());

            checkActivityClient();
        }`  替换成

if (BuildCompat.isS()) { Object record = BRActivityThread.get(BlackBoxCore.mainThread()).getLaunchingActivity(token); if (record != null) { ActivityThreadActivityClientRecordContext clientRecordContext = BRActivityThreadActivityClientRecord.get(record); clientRecordContext._set_intent(stubRecord.mTarget); clientRecordContext._set_activityInfo(activityInfo); clientRecordContext._set_packageInfo(BActivityThread.currentActivityThread().getPackageInfo()); } else { LaunchActivityItemContext launchActivityItemContext = BRLaunchActivityItem.get(r); launchActivityItemContext._set_mIntent(stubRecord.mTarget); launchActivityItemContext._set_mInfo(activityInfo); } checkActivityClient(); }

问题应该会得到解决

好的，谢谢，我先试下，谢谢您了

[mubasher380]

snapchat is not working here are logs that are comming

Process: com.snapchat.android, PID: 3341
                                                                                                java.lang.SecurityException: Calling uid 10471 cannot set locusIdfor package com.snapchat.android
                                                                                                    at android.os.Parcel.createExceptionOrNull(Parcel.java:3011)
                                                                                                    at android.os.Parcel.createException(Parcel.java:2995)
                                                                                                    at android.os.Parcel.readException(Parcel.java:2978)
                                                                                                    at android.os.Parcel.readException(Parcel.java:2920)
                                                                                                    at android.app.IActivityManager$Stub$Proxy.setActivityLocusContext(IActivityManager.java:8695)
                                                                                                    at java.lang.reflect.Method.invoke(Native Method)
                                                                                                    at top.niunaijun.blackbox.fake.hook.ClassInvocationStub.invoke(ClassInvocationStub.java:110)

[panzhi1]

snapchat is not working here are logs that are comming

Process: com.snapchat.android, PID: 3341
                                                                                                java.lang.SecurityException: Calling uid 10471 cannot set locusIdfor package com.snapchat.android
                                                                                                  at android.os.Parcel.createExceptionOrNull(Parcel.java:3011)
                                                                                                  at android.os.Parcel.createException(Parcel.java:2995)
                                                                                                  at android.os.Parcel.readException(Parcel.java:2978)
                                                                                                  at android.os.Parcel.readException(Parcel.java:2920)
                                                                                                  at android.app.IActivityManager$Stub$Proxy.setActivityLocusContext(IActivityManager.java:8695)
                                                                                                  at java.lang.reflect.Method.invoke(Native Method)
                                                                                                  at top.niunaijun.blackbox.fake.hook.ClassInvocationStub.invoke(ClassInvocationStub.java:110)

在hook setActivityLocusContext 方法的地方替换包名为容器包名

[Kgo-GitHub]

Brother can anyone fix open close problem in android 13 and 14

please reply